PiaoYes
Released 21 years, 4 months ago. July 2003
Copyright © MegaSecurity
By ?
Informations
| From | China |
| Author | ? |
| Family | PiaoYes |
| Category | Remote Access |
| Version | PiaoYes |
| Released Date | Jul 2003, 21 years, 4 months ago. |
| Language | Delphi, compressed with ASPack |
Additional Information
Client1.exe:
dropped servers:
c:\WINDOWS\notepad.jmp
c:\WINDOWS\SYSTEM\Explorer.exe
c:\WINDOWS\SYSTEM\internat.dic
size: 282.112 bytes
startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "internat"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices "Explorer"
HKEY_CLASSES_ROOT\txtfile\shell\open\command "(Default)"
registry added:
HKEY_CLASSES_ROOT\.dic
HKEY_CLASSES_ROOT\.jmp
HKEY_LOCAL_MACHINE\Software\piaoyes
Client2.exe
dropped servers:
c:\WINDOWS\notepad.jmp
c:\WINDOWS\SYSTEM\Explorer.exe
c:\WINDOWS\SYSTEM\wing32.dll
c:\WINDOWS\SYSTEM\internat.dic
startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "internat"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices "piaoyes"
HKEY_CLASSES_ROOT\txtfile\shell\open\command "(Default)"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "GinaDLL"
registry added:
HKEY_CLASSES_ROOT\.dic
HKEY_CLASSES_ROOT\.jmp
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
HKEY_LOCAL_MACHINE\Software\piaoyes
files added:
c:\WINDOWS\SYSTEM\client.exeIf you recognize any personal information on this page and wish to have it removed or redacted, please contact us at jplesueur@phrozen.io. We are committed to protecting your privacy in accordance with GDPR regulations.